@cspeach/cli 1.1.25 → 1.1.27

package/dist/renderer/footer-line.js

@@ -80,18 +80,24 @@ export function formatFooterLine(s, width) {
 export function turnSpendText(p) {
     if (creditsActive()) {
         const c = p.credits;
-        if (!c || c.chargedThisTurn === null)
+        // 2026-10-02: the whole user request (every model round), not its last round.
+        if (!c || c.chargedThisRequest === null)
             return CREDITS_PENDING;
-        return formatCredits(c.chargedThisTurn, c.unitLabel);
+        return formatCredits(c.chargedThisRequest, c.unitLabel);
     }
     return p.costThisTurn != null ? formatCost(p.costThisTurn) : '';
 }
-/** `/<skill> · <tokens> tokens · <this-turn spend> · <time>` — one dim line, no newline. */
+/**
+ * `/<skill> · <tokens> tokens · <this-turn spend> · <time>` — one dim line, no newline.
+ * 2026-10-02 (owner): in credits mode (a managed customer) the token count is
+ * dropped — credits only, so nobody works out "credits per token".
+ */
 export function formatTurnReceipt(p) {
     const parts = [];
     if (p.skill && p.skill !== '(none)')
         parts.push(p.skill.startsWith('/') ? p.skill : `/${p.skill}`);
-    parts.push(`${p.tokens.toLocaleString('en-US')} tokens`);
+    if (!creditsActive())
+        parts.push(`${p.tokens.toLocaleString('en-US')} tokens`);
     if (p.spend)
         parts.push(p.spend);
     if (p.ms > 0)

package/dist/renderer/status-footer.js

@@ -71,13 +71,14 @@ export function formatStatusFooter(params) {
     const shortSession = sessionId.slice(0, 8);
     const skillDisplay = skill.startsWith('/') ? skill : `/${skill}`;
     const turns = `${turnCount} turn${turnCount === 1 ? '' : 's'}`;
-    const tokStr = tokens.toLocaleString() + ' tok this turn';
-    const cachedStr = cachedTokens > 0 ? `${cachedTokens.toLocaleString()} cached` : '';
-    const elapsed = elapsedMs > 0 ? `${(elapsedMs / 1000).toFixed(1)}s` : '';
     // Credits mode: the whole spend story collapses into ONE customer-facing
     // segment (turn · session · balance) in place of the two dollar segments.
     // (Classic receipt only — the Ink 'turn' variant returned above.)
+    // 2026-10-02 (owner): and no token/cached counts — credits only.
     const inCredits = creditsActive();
+    const tokStr = inCredits ? '' : tokens.toLocaleString() + ' tok this turn';
+    const cachedStr = !inCredits && cachedTokens > 0 ? `${cachedTokens.toLocaleString()} cached` : '';
+    const elapsed = elapsedMs > 0 ? `${(elapsedMs / 1000).toFixed(1)}s` : '';
     const costTurnStr = inCredits
         ? (credits ? formatCreditsLine(credits) : CREDITS_PENDING)
         : (costThisTurn != null ? formatCost(costThisTurn) : '');
@@ -92,7 +93,7 @@ export function formatStatusFooter(params) {
         sapAlias,
         skillDisplay,
         turns,
-        tokStr,
+        ...(tokStr ? [tokStr] : []),
         ...(costTurnStr ? [costTurnStr] : []),
         ...(cachedStr ? [cachedStr] : []),
         ...(costSessStr ? [costSessStr] : []),

package/dist/renderer/thinking-heartbeat.js

@@ -49,7 +49,8 @@ const GENERIC_SUFFIXES = [
     { at: 30_000, suffix: ' (30s)' },
     { at: 60_000, suffix: ' (60s — still running, hold on)' },
     { at: 120_000, suffix: ' (2m — still running; Ctrl+C aborts the turn)' },
-    { at: 300_000, suffix: ' (5m — likely stuck; Ctrl+C and check the VPN)' },
+    // 2026-10-04: never assume a VPN — many users sit on the company network.
+    { at: 300_000, suffix: ' (5m — likely stuck; Ctrl+C and check network access to the SAP system)' },
 ];
 /**
  * 2026-07-06 (audit-timeout) — the plan-chain audit's own liveness schedule.

package/dist/renderer/tool-labels.js

@@ -192,6 +192,7 @@ const RULES = {
     fiori_scaffold: (a) => ({ verb: 'Scaffolded app', object: shortLeft(str(a['basePath']) ?? '') }),
     fiori_apply: (a) => ({ verb: 'Applied', object: shortRight([str(a['entry']), str(a['appDir'])].filter(Boolean).join(' · ')) }),
     fiori_list: () => ({ verb: 'Listed patterns', object: '' }),
+    fiori_deploy: (a) => ({ verb: str(a['mode']) === 'deploy' ? 'Deploy app' : 'Deploy test', object: shortRight(str(a['appDir']) ?? '') }),
     fiori_deploy_config: (a) => ({ verb: 'Deploy config', object: shortRight(str(a['name']) ?? str(a['appDir']) ?? '') }),
     fiori_fe_extend: (a) => ({ verb: 'Extended app', object: shortRight([str(a['op']), str(a['basePath'])].filter(Boolean).join(' · ')) }),
     fiori_preview: (a) => ({ verb: 'Preview', object: shortRight([str(a['action']) ?? 'start', str(a['appDir'])].filter(Boolean).join(' ')) }),
@@ -258,7 +259,7 @@ const PRESENT = {
     'Read playbook': 'Reading playbook', 'Read convention': 'Reading convention', 'Merged CCA': 'Merging CCA',
     'Merged progress': 'Merging progress', 'Checked background': 'Checking background',
     Subagent: 'Running subagent', Reader: 'Running reader', 'Drafted schedule': 'Drafting schedule', Applied: 'Applying',
-    'Listed patterns': 'Listing patterns', 'Deploy config': 'Writing deploy config', 'Extended app': 'Extending app',
+    'Listed patterns': 'Listing patterns', 'Deploy config': 'Writing deploy config', 'Deploy app': 'Deploying app', 'Deploy test': 'Test-deploying app', 'Extended app': 'Extending app',
     Preview: 'Preview', 'Searched samples': 'Searching samples', 'Read sample': 'Reading sample',
     'Audited metadata': 'Auditing metadata', 'Extended model': 'Extending model',
     'Checked capability': 'Checking capability',

package/dist/repl.js

@@ -38,6 +38,7 @@ import { makeSessionId, saveSession, sessionSaved } from './session/store.js';
 import { newSession } from './session/schema.js';
 import { resolveModelRole } from './models/resolve.js';
 import { loadServerModelConfig, loadCustomerModelConfig, fetchToolLoadingMode } from './models/server-config.js';
+import { prefetchRouterPrompt } from './router/router-prompt.js';
 import { repinResumedSessionModel } from './session/repin-model.js';
 import { computeCost } from './cost/pricing.js';
 import { formatSessionSpendValue } from './repl/session-spend-line.js';
@@ -60,7 +61,7 @@ import { enqueueSteering } from './agent/steering-queue.js';
 import { classifyPrompt, parseShortcut, rejectUnknownSkill } from './router/classifier.js';
 import { pipedRoutingPick } from './router/piped-routing.js';
 import { decideRouting } from './router/routing-decision.js';
-import { routingFailureFromError, routingFailureFromResult, routingFailureNotice, routingFailureOutcome, routingFailureText } from './router/routing-failure.js';
+import { routingFailureFromError, routingFailureFromResult, routingFailureNotice, routingFailureOutcome, routingFailureText, routingFallbackFromError } from './router/routing-failure.js';
 import { coachingPickerClassic } from './ui/coaching-picker-classic.js';
 import { coachingPickerEmitter } from './ui/coaching-picker-emitter.js';
 import { globalStore as sapStateStore } from './ui/sap-state-store.js';
@@ -553,6 +554,9 @@ export async function runRepl(opts) {
         loadCustomerModelConfig(cfg, async () => apiKey ?? '', { timeoutMs: 1500 }),
         // Task 16 (F13) — BYOK reads only the served tool_loading (signed in only).
         fetchToolLoadingMode(cfg, async () => apiKey ?? '', { timeoutMs: 1500 }),
+        // 2026-10-02 — BYOK / ai-hub route on the laptop: prefetch the signed
+        // router prompt (public manifest, no prompt data) under the same cap.
+        cfg.llm?.mode === 'byok' || cfg.llm?.mode === 'ai-hub' ? prefetchRouterPrompt({ timeoutMs: 1500 }) : Promise.resolve(),
     ]);
     // Credits (2026-09-16) — resolve ONCE, before any cost figure can render.
     // A managed customer is billed in credits at a multiplier we do not
@@ -1318,8 +1322,16 @@ export async function runRepl(opts) {
                             }, { signal: routingCtl.signal });
                         }
                         catch (err) {
-                            if (!routingCtl.signal.aborted)
-                                throw err;
+                            if (!routingCtl.signal.aborted) {
+                                // Live fix 2026-10-02 — a classify failure (proxy HTTP 500,
+                                // an unreadable body) dropped the turn. Continue on the
+                                // bundled local rules: the offline handling below prints one
+                                // notice, then the low-confidence picker (or fix 10's stay).
+                                const fallback = routingFallbackFromError(err, prompt);
+                                if (!fallback)
+                                    throw err;
+                                c = fallback;
+                            }
                         }
                         finally {
                             routingAbort = null;
@@ -1467,6 +1479,8 @@ export async function runRepl(opts) {
                         // Task 9 — run-lease identity + takeover prompt (concurrent
                         // resume guard; inkAwarePrompt answers '' in headless = decline).
                         sessionId: session.id,
+                        // 2026-10-02 — deploy card on a direct resume into ui.deploy.
+                        sapAlias: session.sap_system ?? undefined,
                         prompt: inkAwarePrompt,
                         confirm: inkAwareConfirm,
                         log: (...lines) => chunkEmitter.emit('chunk', lines.join('\n') + '\n'),
@@ -1494,6 +1508,7 @@ export async function runRepl(opts) {
                             phaseIds: planResume.reauditPhaseIds ?? [planResume.reauditPhaseId],
                             sessionId: session.id,
                             cwd: process.cwd(),
+                            sapAlias: session.sap_system ?? undefined,
                             mode: planResume.effectiveMode ?? 'step',
                             modeFlag: planResume.mode,
                             // Off-switch (I3) — footer honesty on re-audit boards; (I2) the
@@ -1833,6 +1848,7 @@ export async function runRepl(opts) {
                         executedPhaseId: planResume.nextPhaseId,
                         sessionId: session.id,
                         cwd: process.cwd(),
+                        sapAlias: session.sap_system ?? undefined,
                         mode: planResume.effectiveMode ?? 'step',
                         modeFlag: planResume.mode,
                         // Off-switch — skips the normal post-phase audit when 'off'; the
@@ -1903,6 +1919,7 @@ export async function runRepl(opts) {
                         outcome: planOutcome,
                         sessionId: session.id,
                         cwd: process.cwd(),
+                        sapAlias: session.sap_system ?? undefined,
                         subagentDispatches: planSubagentDispatches,
                         prompt: inkAwarePrompt,
                         confirm: inkAwareConfirm,
@@ -3077,11 +3094,22 @@ export async function runRepl(opts) {
             }
             else {
                 try {
-                    const c = await classifyPrompt(prompt, {
-                        sap_system: selectedAlias,
-                        last_skill: session.last_skill ?? null,
-                        last_object: extractedObject ?? session.last_object ?? null,
-                    });
+                    let c;
+                    try {
+                        c = await classifyPrompt(prompt, {
+                            sap_system: selectedAlias,
+                            last_skill: session.last_skill ?? null,
+                            last_object: extractedObject ?? session.last_object ?? null,
+                        });
+                    }
+                    catch (err) {
+                        // Live fix 2026-10-02 — same as the Ink path: a classify failure
+                        // continues on the bundled local rules instead of ending the turn.
+                        const fallback = routingFallbackFromError(err, prompt);
+                        if (!fallback)
+                            throw err;
+                        c = fallback;
+                    }
                     if (c.screenshot)
                         console.log(formatInfo(`Screenshot: ${c.screenshot}`).trimEnd());
                     // Fix 10 (2026-09-26): routing failed mid-skill → stay in the
@@ -3214,6 +3242,8 @@ export async function runRepl(opts) {
                     configAudit: cfg.plan_audit,
                     // Task 9 — run-lease identity + takeover prompt (classic mirror).
                     sessionId: session.id,
+                    // 2026-10-02 — deploy card on a direct resume into ui.deploy.
+                    sapAlias: session.sap_system ?? undefined,
                     prompt: inkAwarePrompt,
                     confirm: inkAwareConfirm,
                     log: (...lines) => lines.forEach((l) => console.log(l)),
@@ -3240,6 +3270,7 @@ export async function runRepl(opts) {
                         phaseIds: planResume.reauditPhaseIds ?? [planResume.reauditPhaseId],
                         sessionId: session.id,
                         cwd: process.cwd(),
+                        sapAlias: session.sap_system ?? undefined,
                         mode: planResume.effectiveMode ?? 'step',
                         modeFlag: planResume.mode,
                         // Off-switch (I3/I2) — classic mirror; see the Ink re-audit site.
@@ -3551,6 +3582,7 @@ export async function runRepl(opts) {
                     executedPhaseId: planResume.nextPhaseId,
                     sessionId: session.id,
                     cwd: process.cwd(),
+                    sapAlias: session.sap_system ?? undefined,
                     mode: planResume.effectiveMode ?? 'step',
                     modeFlag: planResume.mode,
                     // Off-switch (I3/I2) — classic mirror of the Ink chain call: skip
@@ -3620,6 +3652,7 @@ export async function runRepl(opts) {
                     outcome: planOutcome,
                     sessionId: session.id,
                     cwd: process.cwd(),
+                    sapAlias: session.sap_system ?? undefined,
                     subagentDispatches: planSubagentDispatches,
                     prompt: inkAwarePrompt,
                     confirm: inkAwareConfirm,

package/dist/router/byok-classifier.js

@@ -0,0 +1,159 @@
+/**
+ * Skill routing without our server (2026-10-02): BYOK and ai-hub.
+ *
+ * The site promises that in BYOK (the customer's own Anthropic key) prompts
+ * never touch CSPeach servers, and that in ai-hub they stay in the customer's
+ * SAP BTP landscape. Until today classifyPrompt POSTed every free-text prompt
+ * — plus pasted screenshots, the SAP alias and the last skill — to
+ * {proxy}/v1/classify in every mode, and the proxy classified it on CSPeach's
+ * key. Now:
+ *   - BYOK: one Messages API call, direct to the model API, with the
+ *     customer's keychain key; router model = the one CSPeach serves
+ *     (roles.router from the public /v1/model-config), with a default.
+ *   - ai-hub (review item 3): the same call through the customer's own hub
+ *     (llm.ai_hub_base_url, their token, their model alias), with today's
+ *     field set only — no output_config, like the ai-hub provider.
+ *
+ * Same quality as managed: the request and its handling come from
+ * router-core.ts, a verbatim copy of the proxy's router core (system prompt
+ * from the signed manifest or the bundled copy — router-prompt.ts; JSON
+ * schema via structured outputs; thinking off; max_tokens 600; self-heal
+ * without output_config on a 400; one retry on an unparseable answer; then the
+ * low-confidence fallback).
+ *
+ * Latency (review item 1): ONE overall deadline covers every call (self-heal
+ * and retry included); past it the caller routes by local rules with the
+ * timeout notice. Ctrl+C aborts the in-flight call at once.
+ *
+ * Nothing in here talks to a CSPeach host. The only other network read on
+ * this path is the public signed manifest (router-prompt.ts), which carries
+ * no prompt data.
+ */
+import Anthropic from '@anthropic-ai/sdk';
+import keychain from '../auth/keychain.js';
+import { byokRouterModel } from '../models/server-config.js';
+import { addRouterSpend } from '../cost/router-spend.js';
+import { loadRouterPrompt } from './router-prompt.js';
+import { ROUTER_UNPARSEABLE_RESULT, buildRouterRequest, runRouterCalls, } from './router-core.js';
+/** Same keychain entry the BYOK provider reads (byok-provider.ts) and login writes. */
+export const BYOK_KEYCHAIN_SERVICE = 'cspeach.anthropic';
+export const BYOK_KEYCHAIN_ACCOUNT = 'api-key';
+/** Same keychain entry the ai-hub provider reads. */
+const AI_HUB_KEYCHAIN_SERVICE = 'cspeach.ai-hub';
+const AI_HUB_KEYCHAIN_ACCOUNT = 'token';
+/** The ai-hub provider's default alias (ai-hub-provider.ts). */
+const AI_HUB_DEFAULT_MODEL = 'anthropic--claude-opus-4-6';
+/** Per model call; the SDK retries a timeout / dropped connection once (maxRetries 1). */
+const ROUTER_CALL_TIMEOUT_MS = 8000;
+/** One deadline for the whole routing step (every call, self-heal and retry included). */
+const ROUTER_DEADLINE_MS = 10_000;
+let deadlineOverride;
+/** Test-only: shorten the overall routing deadline (undefined = default). */
+export function __setRouterDeadlineForTests(ms) {
+    deadlineOverride = ms;
+}
+let selfHealWarned = false;
+/** Test-only: re-arm the once-per-session self-heal warning. */
+export function __resetRouterWarnForTests() {
+    selfHealWarned = false;
+}
+export class ByokRouterFailure extends Error {
+    failure;
+    constructor(failure) {
+        super(`router call failed (${failure.kind})`);
+        this.failure = failure;
+        this.name = 'ByokRouterFailure';
+    }
+}
+function causeOf(err) {
+    const e = err;
+    if (e?.cause)
+        return `${e.cause.code ?? e.cause.errno ?? 'unknown'}${e.cause.message ? `: ${e.cause.message}` : ''}`;
+    return e?.message ?? String(err);
+}
+function cancelled() {
+    const e = new Error('routing cancelled');
+    e.name = 'AbortError';
+    return e;
+}
+/**
+ * Classify one prompt on the laptop. Returns the router's answer (or the
+ * low-confidence fallback when it gave no parseable answer twice). Throws:
+ * AbortError on a user cancel; ByokRouterFailure for a model-API failure or
+ * the overall deadline; an Error when no key / token is configured.
+ */
+export async function classifyByok(prompt, context, images, opts = {}) {
+    const target = opts.target ?? { mode: 'byok' };
+    if (opts.signal?.aborted)
+        throw cancelled();
+    const key = target.mode === 'byok'
+        ? await keychain.getPassword(BYOK_KEYCHAIN_SERVICE, BYOK_KEYCHAIN_ACCOUNT)
+        : await keychain.getPassword(AI_HUB_KEYCHAIN_SERVICE, AI_HUB_KEYCHAIN_ACCOUNT);
+    if (!key) {
+        throw new Error(target.mode === 'byok'
+            ? 'BYOK Anthropic API key not configured — run: cspeach config set llm.byok_key <key>'
+            : 'AI Hub token not configured — run: cspeach config set llm.ai_hub_token <token>');
+    }
+    // One controller for the whole step: the user's cancel OR the deadline.
+    const ctrl = new AbortController();
+    let deadlineHit = false;
+    const timer = setTimeout(() => { deadlineHit = true; ctrl.abort(); }, deadlineOverride ?? ROUTER_DEADLINE_MS);
+    timer.unref?.();
+    const onUserAbort = () => ctrl.abort();
+    opts.signal?.addEventListener('abort', onUserAbort, { once: true });
+    const userCancelled = () => opts.signal?.aborted === true;
+    try {
+        const { prompt: routerPrompt } = await loadRouterPrompt({ signal: ctrl.signal });
+        const model = target.mode === 'byok' ? byokRouterModel() : (target.modelAlias ?? AI_HUB_DEFAULT_MODEL);
+        const full = buildRouterRequest(model, prompt, context, images, routerPrompt);
+        // ai-hub: today's field set only (the hub has no flag for newer fields).
+        const request = target.mode === 'byok'
+            ? full
+            : (({ output_config: _dropped, ...rest }) => rest)(full);
+        const sdk = new Anthropic({
+            apiKey: key,
+            maxRetries: 1,
+            timeout: ROUTER_CALL_TIMEOUT_MS,
+            ...(target.mode === 'ai-hub' ? { baseURL: target.baseURL } : {}),
+        });
+        const { result } = await runRouterCalls((req) => sdk.messages.create(req, { signal: ctrl.signal }), request, {
+            // Once per session — a model that rejects structured outputs would
+            // otherwise print this on every prompt.
+            warn: (message, detail) => {
+                if (selfHealWarned)
+                    return;
+                selfHealWarned = true;
+                console.warn(message, detail);
+            },
+            // The customer's own bill (BYOK) — counted in the USD meter as each
+            // call finishes, so a deadline / cancel after call 1 keeps call 1
+            // (review S1). ai-hub is billed by their BTP account at rates we
+            // don't know: not priced here.
+            onCall: (c) => { if (target.mode === 'byok')
+                addRouterSpend(model, c.usage); },
+        });
+        return result ?? { ...ROUTER_UNPARSEABLE_RESULT, alternates: [] };
+    }
+    catch (err) {
+        if (userCancelled())
+            throw cancelled();
+        if (deadlineHit)
+            throw new ByokRouterFailure({ kind: 'timeout', detail: 'routing deadline' });
+        if (err instanceof Anthropic.APIUserAbortError)
+            throw cancelled();
+        if (err instanceof Anthropic.APIConnectionTimeoutError) {
+            throw new ByokRouterFailure({ kind: 'timeout', detail: causeOf(err) });
+        }
+        if (err instanceof Anthropic.APIConnectionError) {
+            throw new ByokRouterFailure({ kind: 'connection', detail: causeOf(err) });
+        }
+        if (err instanceof Anthropic.APIError && typeof err.status === 'number') {
+            throw new ByokRouterFailure({ kind: 'http', status: err.status });
+        }
+        throw err;
+    }
+    finally {
+        clearTimeout(timer);
+        opts.signal?.removeEventListener('abort', onUserAbort);
+    }
+}

package/dist/router/classifier.js

@@ -1,10 +1,11 @@
 import { loadConfig } from '../config/loader.js';
 import { getStore } from '../auth/api-key.js';
-import { classify as classifyLocal } from '../classifier/client.js';
+import { classify as classifyLocal, classifyWithConfidence } from '../classifier/client.js';
 import { SKILL_CATALOG, SKILL_ALIASES, resolveSkillAlias } from '../skill-catalog.js';
 import { isBuiltinCommandHead } from '../repl/builtin-commands.js';
 import { expandImageAttachments } from '../projects/image-attachments.js';
 import { expandImageChips } from '../ui/clipboard-image.js';
+import { classifyByok, ByokRouterFailure } from './byok-classifier.js';
 /** A non-2xx answer from the classify endpoint (fix 9: carries the kind). */
 export class ClassifyHttpError extends Error {
     status;
@@ -15,6 +16,51 @@ export class ClassifyHttpError extends Error {
         this.name = 'ClassifyHttpError';
     }
 }
+/**
+ * Live fix 2026-10-02 — the classify endpoint answered 2xx but the body was
+ * not a classification (not JSON, or no skill). Used to escape as a raw
+ * SyntaxError; now a routing failure the callers degrade from.
+ */
+export class ClassifyBodyError extends Error {
+    transport_kind = 'failed';
+    constructor() {
+        super('classifier returned an unreadable answer');
+        this.name = 'ClassifyBodyError';
+    }
+}
+/**
+ * The bundled local-rules pick used whenever the remote classifier gives no
+ * answer (transport failure, and since 2026-10-02 any classify failure).
+ * Confidence 0.3 < 0.60 ⇒ the low-confidence path (picker / one-shot notice).
+ *
+ * 2026-10-02: the no-rule-matched default is abap-explain (read-only,
+ * generic — the same default the router uses for an unparseable answer). It
+ * was abap-radar, retired 2026-06-28 (merged into abap-explain's technical
+ * mode).
+ */
+export function localRulesResult(prompt) {
+    return { skill: classifyLocal(prompt) ?? 'abap-explain', confidence: 0.3, alternates: [] };
+}
+/**
+ * Local mode's routing (2026-10-02, review items 3 + S2): the bundled rules
+ * only — the prompt never leaves the laptop. A matching rule is a real pick,
+ * not a failure fallback, so there is no "couldn't route" notice: an
+ * unambiguous (strong) rule routes silently (0.85), any other match opens the
+ * picker preselected (0.6); no match is the low-confidence local-rules result
+ * (picker, abap-explain).
+ *
+ * Why not the local model: local endpoints (Ollama / vLLM, OpenAI-compatible)
+ * have no structured outputs, small local models are unreliable at strict
+ * JSON routing, and a large one adds seconds per prompt on a laptop — on top
+ * of the turn itself. Local mode is text-only today; instant, offline,
+ * deterministic rules with a one-key confirm fit it better.
+ */
+function localModeResult(prompt) {
+    const hit = classifyWithConfidence(prompt);
+    return hit
+        ? { skill: resolveSkillAlias(hit.skill), confidence: hit.confidence, alternates: [] }
+        : localRulesResult(prompt);
+}
 // 8s — sized to cover the observed Fly cold-start (~3.2s on the 2026-05-20
 // probe) plus headroom for a slow network. Tighter values risk timing out
 // legitimate cold-start hits and burning the retry budget on the same.
@@ -111,6 +157,31 @@ export async function classifyPrompt(prompt, context, opts = {}) {
         throw new Error('slash command reached the classifier — explicit /commands must be routed before classification (CLI bug, please report)');
     }
     const cfg = await loadConfig();
+    // 2026-10-02 (local routing): outside managed mode the prompt never goes to
+    // a CSPeach host. BYOK classifies on the laptop, direct to the model API
+    // with the customer's own key; ai-hub through the customer's own hub;
+    // local by the bundled rules (byok-classifier.ts / localModeResult).
+    // Managed keeps /v1/classify below, byte-identical.
+    const mode = cfg.llm?.mode;
+    if (mode === 'local') {
+        if (opts.signal?.aborted)
+            throw routingCancelled();
+        return localModeResult(prompt);
+    }
+    if (mode === 'byok')
+        return classifyPromptByok(prompt, context, opts, { mode: 'byok' });
+    if (mode === 'ai-hub') {
+        const baseURL = cfg.llm.ai_hub_base_url;
+        if (!baseURL)
+            throw new Error('ai-hub mode requires llm.ai_hub_base_url — run: cspeach config set llm.ai_hub_base_url <url>');
+        // llm.ai_hub_router_model (optional, 2026-10-02) routes on a cheaper /
+        // faster deployment; unset ⇒ the session alias.
+        return classifyPromptByok(prompt, context, opts, {
+            mode: 'ai-hub',
+            baseURL,
+            modelAlias: cfg.llm.ai_hub_router_model ?? cfg.llm.ai_hub_model_alias,
+        });
+    }
     const store = await getStore();
     const key = await store.get();
     if (!key)
@@ -147,11 +218,8 @@ export async function classifyPrompt(prompt, context, opts = {}) {
         // local rules so the user's turn is NOT dropped — they still get a
         // coaching picker (confidence 0.3 < 0.60 = picker decision), and the
         // REPL surfaces an offline hint with the real cause.
-        const skill = classifyLocal(prompt) ?? 'abap-radar';
         return {
-            skill,
-            confidence: 0.3,
-            alternates: [],
+            ...localRulesResult(prompt),
             offline: true,
             transport_error: lastErr ? extractCause(lastErr) : 'unknown',
             transport_kind: transportKindOf(lastErr),
@@ -159,7 +227,28 @@ export async function classifyPrompt(prompt, context, opts = {}) {
     }
     if (!r.ok)
         throw new ClassifyHttpError(r.status);
-    const result = (await r.json());
+    // Live fix 2026-10-02: an unreadable 2xx body is a routing failure, not a
+    // raw SyntaxError escaping to the caller.
+    let result;
+    try {
+        result = (await r.json());
+    }
+    catch {
+        throw new ClassifyBodyError();
+    }
+    return normaliseResult(result);
+}
+/**
+ * The checks every classification gets, wherever it came from (the proxy, or
+ * since 2026-10-02 the BYOK router on the laptop).
+ */
+function normaliseResult(result) {
+    if (!result || typeof result.skill !== 'string' || result.skill === '')
+        throw new ClassifyBodyError();
+    if (typeof result.confidence !== 'number')
+        result.confidence = 0;
+    if (!Array.isArray(result.alternates))
+        result.alternates = [];
     // Portfolio-merge resilience (2026-06-12): the proxy classifier's skill
     // list can lag a rename (it still knows 'abap-dump-analyze' until its
     // SKILL_LIST is redeployed). Map retired names — primary and alternates —
@@ -171,6 +260,41 @@ export async function classifyPrompt(prompt, context, opts = {}) {
     }
     return result;
 }
+/**
+ * BYOK / ai-hub branch of classifyPrompt (2026-10-02). Same contract as the managed
+ * path — a result, a low-confidence local-rules result when the router could
+ * not be reached, ClassifyHttpError for an HTTP failure, AbortError on cancel
+ * — so every caller (Ink REPL, classic REPL, one-shot) is unchanged.
+ */
+async function classifyPromptByok(prompt, context, opts, target) {
+    if (opts.signal?.aborted)
+        throw routingCancelled();
+    const images = await promptImages(prompt, opts.cwd ?? process.cwd());
+    if (opts.signal?.aborted)
+        throw routingCancelled();
+    try {
+        const result = await classifyByok(prompt, { sap_system: context.sap_system, last_skill: context.last_skill }, images, { signal: opts.signal, target });
+        return normaliseResult({ ...result });
+    }
+    catch (err) {
+        if (opts.signal?.aborted)
+            throw routingCancelled();
+        if (err instanceof ByokRouterFailure) {
+            const f = err.failure;
+            if (f.kind === 'http')
+                throw new ClassifyHttpError(f.status);
+            // The model API was not reached. 'failed', not 'network': the network
+            // notice names the CSPeach service, which BYOK routing never calls.
+            return {
+                ...localRulesResult(prompt),
+                offline: true,
+                transport_error: f.detail,
+                transport_kind: f.kind === 'timeout' ? 'timeout' : 'failed',
+            };
+        }
+        throw err;
+    }
+}
 export function parseShortcut(input) {
     // `/skill-name rest` → { skill: 'abap-skill-name', prompt: 'rest' }
     //   abap- prefix auto-prepended if missing (all skills in KV use abap-* namespace).